Webhook signature defined.
A webhook signature is a hash sent alongside a webhook, usually in a header like x-form-signature, that lets the receiver verify the payload really came from the sender and was not altered in transit.
How a webhook signature works
A webhook endpoint is a URL that anyone on the internet can POST to, so the receiver has no built-in way to know a request is genuine. A signature closes that gap. The sender and receiver share a secret, and for every webhook the sender computes a hash (an HMAC) over the exact bytes of the request body, keyed with that secret, and puts the result in a header.
When the request arrives, your handler recomputes the same hash over the raw body it received and compares the two with a constant-time check. A match proves two things at once: only the holder of the secret could have produced that hash (authenticity), and if a single byte of the body had changed the hash would differ (integrity).
For a form backend the payload is a submission, so a webhook signature is what stops an attacker from POSTing fake leads to your endpoint. FormWire signs every webhook this way and documents the exact header and verification steps.
Two guarantees in one header.
Authenticity
Only the party holding the shared secret can produce a matching hash, so a verified signature proves the request came from the real sender.
Integrity
The hash covers the raw body, so any change in transit (even a single character) breaks the match and the request is rejected.
Built on HMAC
The signature is an HMAC keyed with your webhook secret, the standard construction for authenticating a message with a shared key.
Related questions
Because IP addresses are easy to spoof and hard to pin down, since senders scale across changing ranges. A signature verifies the request itself rather than where it appears to come from, so it holds up even when the network can't be trusted.
Recompute the HMAC over the exact raw bytes you received, before any JSON parsing, using your webhook secret, then compare with a constant-time equality check. The classic bug is hashing re-serialized JSON: parsing and re-encoding changes the bytes, so the hash won't match even though the request was genuine.
FormWire's signature and verification steps →Reject the request with an error and do nothing else. Don't process the body. A mismatch means either the secret is wrong, the body was modified, or the request didn't come from the real sender, and none of those are safe to trust.
No. HTTPS encrypts the connection so nobody can read the payload in transit, but it doesn't tell your endpoint who sent the request. A signature is what proves the identity of the sender and the integrity of the body, which is why signed webhooks run over HTTPS.
Want to see it working?
Read the docsTrust every webhook you receive.
Free tier forever. No credit card required.